Data processing terms.

Who is who

You — the business with an EverConvert account — are the controller of your visitors’ and customers’ personal data. EVERCONVERT.AI LTD, company number 17009673, registered in England and Wales, is the processor.

For your own account data — your name, your email, your billing record — we are the controller, and the privacy notice covers it.

What we process, and why

What we commit to

• Only on your instructions. We process this data to provide the service and for nothing else, unless the law requires it — in which case we tell you first unless we are forbidden to.
• Confidentiality. Everyone with access is bound to keep it confidential, and access is limited to the people who need it to do their job.
• Security. The measures described under security — encryption in transit and at rest, per-workspace isolation enforced in the database itself, least-privilege access, and logged administrative actions.
• Helping you. We assist with access, correction, deletion and portability requests, with impact assessments, and with regulator enquiries.
• Breaches. If personal data we hold for you is breached, we tell you without undue delay and in any case within 48 hours of becoming aware, with what we know and what we are doing.
• Audit. On reasonable notice, once a year, we will answer a security questionnaire and provide the evidence we hold.
• Return and deletion. On request, or when your account closes, we export or delete the data — see the windows below.

What you commit to

• You have a lawful basis for measuring your visitors and messaging your customers.
• Your own privacy notice tells them what is collected. Our privacy notice lists it so you can copy it accurately.
• Where consent is required before measurement, you obtain it and only then let the tag run.
• You do not send us special category data or children’s data.

Sub-processors

You give general authorisation for the companies below. We will tell you before adding or replacing one, and you may object on reasonable data protection grounds — if we cannot resolve it, you may end the affected service and be refunded for time not used.

Tools you connect yourself — Google Tag Manager, Google Analytics, Search Console, Shopify, Stripe, ClickFunnels and the rest — are your own processors, not ours. We read from them on your instruction under the access you grant, and you can revoke it at any time.

Data leaving the UK

Data is stored in the UK or EU. Where a sub-processor above handles it outside the UK, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by UK adequacy regulations where they apply. We have carried out transfer risk assessments for each one.

Retention and deletion

What Eric keeps after the data is gone

Eric gets better by learning patterns, and this is how that is kept lawful. Two layers, kept apart on purpose:

• Your account intelligence. What Eric learns about your funnel, your customers and your messages stays inside your workspace, is only used for you, and is deleted with your account.
• Network intelligence. Statistical patterns across many businesses — for example that removing a particular form field tends to lift mobile sign-ups — may be retained indefinitely and used to improve Eric for everybody. These are aggregated and irreversibly anonymised: no individual, no message and no single customer can be picked out of them, and raw text is never used to train a shared model.

We do not train shared models on your raw data, and we do not sell, rent or trade data with anyone. If you would rather your anonymised patterns stayed out of the network layer entirely, say so and we will exclude your workspace.

Do you need this signed?

Accepting our terms accepts these. If your procurement process needs a countersigned copy, or your own DPA template, email support@everconvert.ai and we will sign one.